Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arb…

Published 23 y ago 2002-12-31 · modified 4 mo ago 2026-06-16 · JSON

CVSS

4.3

v2.0 · NVD

CISA KEV

not known exploited

EPSS

24.3%

percentile 98%

Public exploits

Exploit-DB

Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by injecting script into the HTTP request for the name of a template, which is not filtered in the resulting 404 error message.

Exploit prediction (EPSS)

24.27% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

Exploits and detections

EDB-21548 ColdFusion MX - Missing Template Cross-Site Scripting · remote · 2002-06-13

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:P/A:N`

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

macromedia.com /v1/Handlers/index.cfm?ID=23047 · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/5011 · vdb-entry, x_refsource_BID, x_transferred
online.securityfocus.com /archive/1/277487 · mailing-list, x_refsource_BUGTRAQ, x_transferred
exchange.xforce.ibmcloud.com /vulnerabilities/9360 · vdb-entry, x_refsource_XF, x_transferred

Sources

CVE List: CVE-2002-1700
NVD: CVE-2002-1700

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.